How to Check and Update Your Microsoft Account Verification Methods

What the Microsoft verification setup page does

The page at https://aka.ms/mfasetup is where Microsoft shows you which phone numbers, email addresses, and authenticator apps are currently tied to your account. It's the control center for multi-factor authentication — the extra security step that asks you to prove who you are when you sign in from a new device or location.

When you visit this page, you'll see a list of every verification method Microsoft has on file for you. Some may be outdated (a phone number you no longer use, an email you abandoned years ago). Others may be missing entirely — you might have set up security info once and never checked it again. This page is where you clean that up.

The reason to check it now: if your account gets compromised, Microsoft will try to contact you using these methods to help you regain access. If the phone number is disconnected or the email is inactive, you could be locked out of your own account while someone else uses it.

Key Takeaways

• Visit https://aka.ms/mfasetup while signed into your Microsoft account to see which phone numbers and email addresses are registered for account recovery.
• Remove any verification methods you no longer use or no longer have access to, since outdated contact information can prevent you from recovering your account.
• Add at least one phone number and one email address so Microsoft has multiple ways to reach you if your account is compromised.
• An authenticator app (like Microsoft Authenticator) provides stronger protection than SMS text messages, which can be intercepted.

How to access your verification methods

Go to https://aka.ms/mfasetup in your web browser. You'll be asked to sign in with your Microsoft account (the email and password you use for Outlook, OneDrive, Xbox, or Windows). If you're already signed in, the page loads directly to your security info.

The page shows four sections: phone numbers, email addresses, authenticator apps, and security questions. Each one has an "Add" button and a list of what you've already set up. Next to each existing method is a delete button (usually an X or trash icon) so you can remove it.

If you see a method you don't recognize — a phone number you never added, an authenticator app you didn't install — that's a sign your account may have been compromised. Change your password immediately and remove the unfamiliar method.

Removing verification methods you no longer use

Start by looking at your phone numbers. If you see a number you no longer own, delete it. When you delete a phone number, Microsoft stops using it to send you security codes. This matters because if someone else now has that number, they could receive codes meant for you.

Do the same for email addresses. If you have an old Gmail or Yahoo account listed that you haven't checked in years, remove it. Keep only email addresses you actively use and check regularly.

For authenticator apps, the list shows which apps are connected but not which device they're on. If you see an app you don't recognize, or if you switched phones and the old authenticator is still listed, delete it. You can always add it again on your new device.

Adding current phone numbers and email addresses

You should have at least two ways for Microsoft to reach you. The minimum is one phone number and one email address. Click "Add phone number" and enter a number you use every day — the one in your pocket right now, not a landline you rarely answer.

Microsoft will send a code to that number via text message to verify it's really yours. Enter the code when it arrives. The same process applies to email: click "Add email", enter the address, and confirm the code Microsoft sends to that inbox.

If you have a second phone number (a work phone, a partner's number you can access), add that too. The more ways Microsoft can reach you, the less likely you'll be locked out if one method fails.

Why authenticator apps are stronger than text messages

Text messages are convenient but not secure. Attackers can sometimes intercept SMS codes or trick your phone carrier into redirecting your messages to a different phone. An authenticator app like Microsoft Authenticator, Google Authenticator, or Authy generates codes on your phone itself, where no one else can intercept them.

To add an authenticator app, click "Add authenticator app" on the setup page. Microsoft will show you a QR code. Open your authenticator app, scan the code, and the app will start generating six-digit codes. Enter one code to confirm it's working, and you're done.

If you lose the phone with the authenticator app on it, you'll need your other verification methods (phone number or email) to regain access and remove the old app. This is why having multiple methods matters.

What to do if you can't access the setup page

If you're locked out of your account or can't reach the setup page, go to https://account.microsoft.com/security-info instead. This is the main security page, and it has the same verification method controls.

If you can't sign in at all, go to https://account.live.com/password/reset and choose "I forgot my password". Microsoft will ask you to verify your identity using whatever methods you have on file. This is why keeping your verification methods current is critical — if they're all outdated, you may not be able to prove who you are.

If you're still stuck, Microsoft's account recovery form at https://account.microsoft.com/security-info/verify-identity lets you answer security questions or provide other proof of identity. But this process is slower than having current phone numbers and email addresses ready.

Checking your verification methods regularly

Visit https://aka.ms/mfasetup at least once every six months, especially after you change phones, switch email providers, or get a new phone number. A verification method that works today might be useless next year if you stop using that phone or close that email account.

Set a calendar reminder if you tend to forget. The five minutes it takes to check now could save you hours of account recovery later.

Frequently Asked Questions

What happens if I delete all my verification methods?

You can delete them, but Microsoft will ask you to add at least one before you leave the page. Having zero methods means you can't recover your account if you forget your password or get locked out.

Can someone else see my verification methods if they have my password?

Yes. If someone signs into your account, they can see the phone numbers and email addresses you've registered. This is another reason to change your password immediately if you think your account is compromised, and to remove any methods that no longer belong to you.

Do I need both a phone number and an email address?

You need at least one, but two is much safer. If your phone is lost or your email is hacked, the other method is your backup. Microsoft recommends having both plus an authenticator app.

What if I added a phone number by mistake?

Click the delete button next to it. The change takes effect immediately. If you delete it by accident, you can add it back the same way you added it the first time.

Does Microsoft charge to update my verification methods?

No. The setup page is free. Microsoft may charge for text message codes depending on your phone plan, but that's between you and your carrier, not Microsoft.